On September 1, 2026, Anthropic announced Enterprise Frontier Safeguards. The mechanism is one sentence. The traffic that Anthropic's frontier models require to be retained will live in the customer's own cloud account, under the customer's encryption keys, access policies and audit logging.
Most of the coverage read that as privacy restored. Read the platform documentation instead. Two sentences in it decide what a regulated buyer is actually agreeing to, and neither sentence is in the announcement.
What the June policy actually says
Anthropic's retention policy for Covered Models took effect on June 9, 2026. Covered Models are the Mythos-class models, plus future models Anthropic designates. The platform documentation names them: "Claude Fable 5.1, Claude Mythos 5.1, Claude Fable 5, and Claude Mythos 5: These models require 30-day data retention and are not available under ZDR unless expressly authorized by Anthropic."
Enforcement sits at the API boundary, not in the contract. A request to a Covered Model from an organization whose retention configuration does not meet the requirement returns a 400 invalid_request_error carrying the message "In order to access this model, your organization or workspace must have data retention enabled." An engineer can establish the firm's posture in a single call.
The documented way through is a workspace. An organization holding a zero data retention arrangement can turn 30-day retention on for one workspace and leave the rest at zero. That console toggle is what most reached for in June. Not everyone did. Reuters reported in June, citing The Verge, that Microsoft restricted employee access to Claude Fable 5 while its legal department evaluated the change.
What Enterprise Frontier Safeguards changes
EFS moves the retained window out of Anthropic's infrastructure and into the customer's. Anthropic does not charge for it. The customer's cloud provider bills the storage, and the reads, writes and data egress. Automated systems read a rolling window of that traffic for signals of serious misuse, including attempts to build offensive cyber or biological capability and signs of leaked credentials. No Anthropic human review is required. The rollout runs in phases starting this fall, so none of it is in production today.
Part of this property already exists, and the documentation says where. On Amazon Bedrock and Google Cloud's Agent Platform, the cloud provider is the data processor and retained data stays inside its environment. On the Claude API, Anthropic is the processor and holds the retained data. EFS extends the Bedrock property to the first-party path. A buyer who routed through Bedrock in June already had it.
Zero data retention was never zero. Anthropic's own documentation says so, in a section titled Retention regardless of arrangement. Hikari Blue · operator note
The sentence nobody quoted
Here it is verbatim, from Anthropic's platform documentation: "Even with ZDR or HIPAA arrangements in place, Anthropic may retain data where required by law or where it has been flagged by Anthropic's automated trust and safety systems. As a result, if a chat or session is flagged, Anthropic may retain inputs and outputs for up to 2 years."
Read the scope. It survives a zero data retention arrangement. It survives a HIPAA business associate agreement. The trigger is an automated classifier, not a subpoena and not a human decision. A vendor risk file that records "ZDR in place" and stops there does not describe this.
The September announcement does not address it. It says misuse signals go to the customer. It does not say whether flagged inputs and outputs leave the customer's account, whether Anthropic holds a copy, or whether the two-year exception still applies once the store sits on the customer's side. That silence is the first thing to put in writing to the vendor.
What actually transfers is the flag
Strip the privacy framing and the transfer is operational. Under the June policy, a flagged session reaches Anthropic, where the support article describes human review as available only through a controlled access path limited to a small set of approved reviewers. Under EFS, the signal reaches the customer. The announcement adds that recipient. It does not say Anthropic stops being one.
Either way, this is a function the enterprise now staffs. Someone receives a signal that a session showed leaked credentials or an attempt at offensive cyber capability. Someone decides how fast. Someone decides whether to preserve the session, whether this is an insider matter, whether legal is in the loop, whether a customer or a regulator has to be told. In financial services, that is a named runbook with an owner and a clock, or it is nothing.
The upside is real and worth naming. Full prompt and completion traffic, in a store the enterprise controls, under its own keys and its own audit log, is the substrate a deployer needs anyway. The EU AI Act requires high-risk AI systems to technically allow the automatic recording of events over the lifetime of the system (EU AI Act, Article 12). Building that store once, and letting the vendor's classifiers read from it, beats reconstructing it from vendor exports later.
The objection, stated plainly
EFS is announced, not shipped. The phased rollout starts this fall and the announcement commits to no date. Nothing in it belongs in a control description written today.
The exposure shift is also narrower than it sounds. A firm that already logs its model traffic through its own gateway holds these records regardless of where the vendor keeps a copy. For that firm, EFS changes the vendor's posture, not its own. It lands hardest on the firm that adopted zero data retention precisely so that no record would exist. That firm becomes the custodian of a rolling window of every prompt its people and its agents send, inside its own perimeter, under its own legal hold and its own retention schedule.
What changes on Monday
Count the workspaces, not the clauses. Establish how many have 30-day retention enabled, and set that count beside what the vendor risk file says the firm's posture is. The June switch was a privacy control in a console. It rarely arrived with an amended assessment behind it.
Then settle the flag path before EFS lands. Name who receives a misuse signal, how long they have to dispose of it, what gets preserved, and when legal is called. That is governance your board can look in the eye, and ordinary work for an AI operating layer. It is not work that finds its owner during the incident.
Which of our workspaces have model data retention enabled today, who receives a misuse flag when one fires, and how long do they have to act on it?
If the first part of that answer arrives as a contract clause rather than a console count, the firm is reading the wrong document. Carry three numbers into the next risk committee: workspaces with retention enabled, the named owner of the flag path, and the window our own store will hold. The documentation makes all three checkable.
- Anthropic (September 1, 2026). Enterprise Frontier Safeguards. Company announcement, attributed as such. Sole source above for: retained data living in cloud infrastructure the customer controls, under the customer's own encryption keys, access policies and audit logging; automated safety monitoring with no Anthropic human review required; misuse signals routed directly to the customer; Anthropic not charging for EFS while the customer's cloud provider bills storage, reads, writes and data egress; the surfaces named as supported, being Claude Code, Claude Enterprise, the Claude Platform, Amazon Bedrock, Claude Platform on AWS, Google's Agent Platform and Microsoft Foundry; development with more than 100 customers across financial services, healthcare, manufacturing, telecom, law, retail and the public sector; and a phased rollout starting later this fall. This is an announcement of future availability, not a shipped control. The announcement does not state what becomes of flagged inputs and outputs under EFS, and that silence is the basis of the question raised above. anthropic.com, Enterprise Frontier Safeguards
- Anthropic. API and data retention. Claude Platform documentation, read September 4, 2026. Primary source for every sentence quoted verbatim above: the designation of Claude Fable 5.1, Claude Mythos 5.1, Claude Fable 5 and Claude Mythos 5 as requiring 30-day retention and being unavailable under ZDR unless expressly authorized by Anthropic; the
400 invalid_request_errorreturned to an organization whose retention configuration does not meet the requirement, and its message text; the statement that on the Claude API, including Claude Platform on AWS, Anthropic handles retained data, while on Amazon Bedrock and Google Cloud's Agent Platform retained data stays within the cloud provider's environment; the identification of Anthropic as data processor on the Claude API, Claude Platform on AWS and Claude in Microsoft Foundry, and of the cloud provider as processor on Bedrock and Google Cloud's Agent Platform; the workspace-level 30-day retention override reached through the workspace privacy controls; and the section headed Retention regardless of arrangement, which states that even with ZDR or HIPAA arrangements in place Anthropic may retain flagged inputs and outputs for up to 2 years. platform.claude.com, API and data retention - Anthropic. Data retention practices for Covered Models. Anthropic Privacy Center support article. Primary source for the June 9, 2026 effective date of the Covered Models policy, for the definition of Covered Models as Mythos-class models and future models with similar capabilities that Anthropic designates, for the statement that Claude Fable 5 and Claude Fable 5.1 share the same underlying model as Claude Mythos 5 and Claude Mythos 5.1, for automatic deletion after 30 days except where content has been flagged by automated trust and safety systems or retention is legally required, and for the description of human review as reachable only through a controlled access path limited to a small set of approved reviewers. privacy.claude.com, data retention for Covered Models
- PYMNTS (June 10, 2026). Microsoft Balks at Anthropic's Claude Fable 5 Data Retention Policy. Cited for one fact of press reporting and nothing else: that Reuters, citing The Verge, reported Microsoft restricting employee access to Claude Fable 5 while its legal department evaluated Anthropic's revised retention requirements. We have not read the underlying Verge report, which is paywalled, and we make no claim about Microsoft's internal policy today. pymnts.com, Microsoft and Claude Fable 5 retention
- Regulation (EU) 2024/1689, Article 12 (Record-keeping). Cited for the requirement that high-risk AI systems technically allow the automatic recording of events over the lifetime of the system. Article 12 addresses high-risk systems and providers of them. It does not, on its own, impose a logging duty on every enterprise deployment, and is used above only to establish that a controlled event store is a substrate a regulated deployer needs independently of any vendor's retention policy. artificialintelligenceact.eu, AI Act Article 12
The Hikari Blue team · Austin, September 2026